[Winpcap-users] RE: Packet timestamp strangeness (Richard Hansen)

[Gianluca Varenni]

----- Original Message ----- 
From: "Ioan Popescu" <ipopescu at dataq.com>
To: <winpcap-users at winpcap.org>
Sent: Friday, June 30, 2006 7:49 AM
Subject: Re: [Winpcap-users] RE: Packet timestamp strangeness (Richard 
Hansen)


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Mark Buchanan wrote:
>> Take a close look at the initial set up of the adapter (pcap_open or
>> pcap_open_live function) - the read timeout parameter is critical to
>> what you are trying to do. The lowest value of 1 ms might not be fast
>> enough for you. Check the documentation - if set to 0 this might return
>> immediately on every packet.
>
> Use "-1" as the timeout to return immediately.
>
>> Try running your packet capture application in real time mode as well. I
>> don't know how to do this in C++ but I did this in my .NET application
>> and it made an enormous difference.
>
> Change process priority in C/C++:

First of all, "real time priority" doesn't mean at all that the thread is 
running real time, because Windows NT is NOT a real time OS. And please be 
careful before raising a thread priority to real time (raising the thread 
priority sometimes just hides the source of problem).

Second, the problem of the "delay" of 7-15ms is perfectly normal. 15ms is 
the scheduling time slice on NT SMP. The timestamp that you obtain from 
GetSystemTime or GetSystemTimeAsFileTime is updated every time slice, so 
every 10 or 15ms (depending on the kernel you are using). WinPcap instead 
uses KeQueryPerformanceCounter to obtain the timestamps (usually). Moreover, 
consider that there's a delay between when we timetag the packets and put in 
the buffer, and when the app receives them. This behavior is controlled by 
the timeout you set in pcap_open_live and by the mintocopy parameter that 
you can set with pcap_setmintocopy(). Please be careful modifying these 
parameters, as they can affect a lot the CPU load. I suggest you to search 
through the winpcap-users archives for more details on mintocopy.

Hope it helps
GV


>
> SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2.2 (MingW32)
>
> iQIVAwUBRKU6CnGK1KGABytRAQq8xQ//SQmh11Htxnx/IuOep6J/IH73zX6EAOe4
> RRutfjjAfZ9YkrBxiDbW5YPTTKg1ksQjJ0Gqw4ayt9RMivWTMtPy8QJ/3ZF/oYsG
> A4Q572VOWe65wWuntKLDvGzX3iHcV9zeSeOxg87eVmTIa22x8qecq2qFIfYvwpKv
> AMRaOanqFL7n3hudmlFuZwnHhe+3tXt+vrWfI1mNzeo+RwlswWzho1aFpvvsQQzV
> 2RRYc4o9EXlGnZ/7RlV3MLNt7qEy5iWE9zN3MWPj/xNIWLyFgocsFD7hYrRlp8PX
> 2MQfuoJ9KT3PJohR4PVmczjp+jEpbd6EBfi4zWiOWUmrv2o+84IvR7JmrWBpQxXu
> vQNgzyyOXzXipJkCjPaDJOciNH/y0g/3QD1IMS3oS6KlEAfUd2MZbQkeYMbZZAzf
> ctE6uHOzKNTS70XR41gVSnwnHH6IubyNP9vcH/jlPmiiuiLMAZbpAo1eJFA1QhuG
> pGuc97c+t2CJcv6AHJA5NaJEiB9IIBKhSYiamMYiWacO00CjdEIK1Fy51kvzT413
> ZkWAw2a/nqyV77ZSLiDGP1zYVJcIA9larRZRb8jkpELx4IenTZakqcI10ASaPrlw
> UEISYo07uvTtWyLv5ZAUV9DOHKTdcCu7n/NOTLnZnyaC6JUkm6qGb8eJETEf4ouI
> 3VTks9jiF8Y=
> =dCPl
> -----END PGP SIGNATURE-----
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users